Groups > linux.debian.user > #200337

Re: Unstable update ridiculousness

From	Roberto C. Sánchez <roberto@debian.org>
Newsgroups	linux.debian.user
Subject	Re: Unstable update ridiculousness
Date	2018-09-20 15:50 +0200
Message-ID	<wA7vb-40B-1@gated-at.bofh.it> (permalink)
References	<wzVu1-5jO-9@gated-at.bofh.it> <wzVDH-5Ca-3@gated-at.bofh.it> <wzVNn-5F3-3@gated-at.bofh.it> <wA1g5-xf-3@gated-at.bofh.it> <wA72a-3Ro-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Sep 20, 2018 at 08:17:51AM -0500, John Hasler wrote:
> didier gaumet writes:
> > Please note that security updates for "unstable" distribution are not
> > managed by the security team. Hence, "unstable" does not get security
> > updates in a timely manner.
> 
> There is no promise of security updates to Unstable but in practice the
> developers upload fixes quite promptly.

To be clear, *targeted* security fixes to unstable are exceptionally
uncommon.  What usually happens is that new upstream releases that fix
security issues tend to be uploaded to unstable.  This sometimes happens
promptly and at other times can come with significant delay.

The reason for the distinction of the targeted security fixes is that
upstream may fix a reported security issue in their development
repository, but it may be some weeks or months before a new upstream
release is made with the fix.  There are occasions where the package
maintainer may cherry-pick the relevant commit(s), as is done for stable
security updates.  However, this is not the norm.  Some upstreams
actually make an effort to obfuscate which commits fix which security
vulnerabilities, which makes the matter even more challenging.

The point is that those who rely on timely security fixes should look
elsewhere than unstable and testing.

Regards,

-Roberto

-- 
Roberto C. Sánchez

Thread

Unstable update ridiculousness Default User <hunguponcontent@gmail.com> - 2018-09-20 03:00 +0200
  Re: Unstable update ridiculousness John Hasler <jhasler@newsguy.com> - 2018-09-20 03:10 +0200
    Re: Unstable update ridiculousness Default User <hunguponcontent@gmail.com> - 2018-09-20 03:20 +0200
      Re: Unstable update ridiculousness didier gaumet <didier.gaumet@gmail.com> - 2018-09-20 09:10 +0200
        Re: Unstable update ridiculousness John Hasler <jhasler@newsguy.com> - 2018-09-20 15:20 +0200
          Re: Unstable update ridiculousness Roberto C. Sánchez <roberto@debian.org> - 2018-09-20 15:50 +0200
            Re: Unstable update ridiculousness Default User <hunguponcontent@gmail.com> - 2018-09-20 22:00 +0200
              Re: Unstable update ridiculousness Ben Caradoc-Davies <ben@transient.nz> - 2018-09-21 00:40 +0200
                Re: Unstable update ridiculousness Default User <hunguponcontent@gmail.com> - 2018-09-21 07:10 +0200
      Re: Unstable update ridiculousness Joe <joe@jretrading.com> - 2018-09-20 10:00 +0200
  Re: Unstable update ridiculousness Ben Caradoc-Davies <ben@transient.nz> - 2018-09-20 03:30 +0200
    Re: Unstable update ridiculousness Joe <joe@jretrading.com> - 2018-09-20 10:10 +0200

csiph-web